# CSRF token missing in AJAX request header

- **ID:** `security/csrf-token-missing-in-ajax-request`
- **Domain:** security
- **Category:** auth_error
- **Error Code:** `403`
- **Verification:** ai_generated
- **Fix Rate:** 90%

## Root Cause

The frontend JavaScript code does not include the CSRF token in the X-CSRF-Token header for AJAX requests, so the server-side middleware rejects the request with a 403 status.

## Version Compatibility

| Version | Status | Introduced | Deprecated |
|---------|--------|------------|------------|
| Django 4.2 | active | — | — |
| Spring Security 6.1 | active | — | — |
| Rails 7.0 | active | — | — |

## Workarounds

1. **In the frontend, add a global AJAX setup to include the CSRF token. For jQuery: $.ajaxSetup({ headers: { 'X-CSRF-Token': $('meta[name="csrf-token"]').attr('content') } })** (95% success)
   ```
   In the frontend, add a global AJAX setup to include the CSRF token. For jQuery: $.ajaxSetup({ headers: { 'X-CSRF-Token': $('meta[name="csrf-token"]').attr('content') } })
   ```
2. **Ensure the meta tag containing the CSRF token is rendered in the HTML template and is accessible to the JavaScript code.** (90% success)
   ```
   Ensure the meta tag containing the CSRF token is rendered in the HTML template and is accessible to the JavaScript code.
   ```
3. **Use a fetch wrapper that automatically adds the CSRF header from a cookie or meta tag to all requests.** (85% success)
   ```
   Use a fetch wrapper that automatically adds the CSRF header from a cookie or meta tag to all requests.
   ```

## Dead Ends

- **** — Disabling CSRF protection globally in the framework removes a critical security control, making the application vulnerable to CSRF attacks. (70% fail)
- **** — Only adding the token to form submissions but not to AJAX requests leaves the AJAX endpoints unprotected. (50% fail)
- **** — Placing the token in a query parameter instead of a header can leak it in server logs and browser history. (60% fail)